October 7, 2025 North Korean hackers have stolen more than US $2 billion worth of cryptocurrency so far this year, with researchers warning that wealthy individual investors have become their newest and most lucrative targets.
Blockchain analysis firm Elliptic says hackers linked to North Korea’s Lazarus Group are responsible for a record-breaking wave of thefts in 2025, accounting for roughly 13 per cent of the country’s gross domestic product, according to United Nations estimates.
For years, the regime’s cyber teams have targeted major crypto exchanges, but they’re now increasingly focusing on individual investors — often those with large holdings but limited security. Elliptic’s chief scientist Dr. Tom Robinson said these personal attacks are harder to detect and frequently go unreported, meaning the true figure could be much higher.
Among the largest confirmed incidents this year was the ByBit hack in February, which saw US $1.4 billion stolen, along with a July attack on WOO X that hit nine users for US $14 million. More than 30 other crypto thefts have been linked to North Korea so far in 2025, with the highest single loss from an individual investor reaching US $100 million.
Western intelligence agencies say the stolen funds are being channelled into North Korea’s nuclear and missile programs. The regime denies involvement, but researchers tracking stolen tokens on the blockchain have identified consistent methods and patterns across multiple attacks.
Elliptic estimates that North Korea’s cyber operations have now stolen over US $6 billion in total. The surge in attacks suggests a shift toward smaller, less-protected targets as sanctions continue to restrict the regime’s access to global finance.
